#!/bin/bash

# AUTHOR:     EUGENE CIURANA
# PROGRAM:    firewall.rc
#
# ABSTRACT:   iptables configuration script.  It blocks all
#             incoming traffic from the outside world,
#             including ICMP pings, and acts as a NAT host
#             for machines in the internal network.
#
#             Allows the user to open specific ports on the
#             server for TCP and UDP traffic.

# Test if it's OK to run this:
if !(test `whoami` = "root")
then
  echo "You must be root to configure the firewall."
  exit 1
fi


if (test -e ./lcfirewall.conf)
then
  echo "Reading lcfirewall.conf locally"
  source ./lcfirewall.conf
elif (test -e /etc/lcfirewall.conf)
then
  echo "Reading lcfirewall.conf from /etc"
  source /etc/lcfirewall.conf
else
  echo lcfirewall.conf file not found. 
  echo ##########################
  echo # FIREWALL RULES NOT SET #
  echo ##########################
  exit 2
fi


# Activate kernel forwarding:
echo 1 > /proc/sys/net/ipv4/ip_forward

# Default policies
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT
/sbin/iptables -P FORWARD ACCEPT

# Flush tables
/sbin/iptables -F
/sbin/iptables -F INPUT
/sbin/iptables -F OUTPUT
/sbin/iptables -F FORWARD
/sbin/iptables -F -t mangle
/sbin/iptables -X
/sbin/iptables -F -t nat

# Create DUMP table
/sbin/iptables -N DUMP > /dev/null
/sbin/iptables -F DUMP
/sbin/iptables -A DUMP -p tcp -j LOG
/sbin/iptables -A DUMP -p udp -j LOG
/sbin/iptables -A DUMP -p tcp -j REJECT --reject-with tcp-reset
/sbin/iptables -A DUMP -p udp -j REJECT --reject-with icmp-port-unreachable
/sbin/iptables -A DUMP -j DROP

# Stateful table
/sbin/iptables -N STATEFUL > /dev/null
/sbin/iptables -F STATEFUL
/sbin/iptables -I STATEFUL -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A STATEFUL -m state --state NEW -i ! $MAIN_NIC -j ACCEPT
/sbin/iptables -A STATEFUL -j DUMP

# Loopback rules
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

# Drop reserved addresses incoming
/sbin/iptables -A INPUT -i $MAIN_NIC -s 127.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i $MAIN_NIC -s $ALTERNATE_NET -j DUMP
/sbin/iptables -A INPUT -i $MAIN_NIC -s 172.16.0.0/12 -j DUMP
/sbin/iptables -A INPUT -i $MAIN_NIC -s 10.0.0.0/8 -j DUMP

# Allow certain inbound ICMP types
/sbin/iptables -A INPUT -i $MAIN_NIC -p icmp --icmp-type destination-unreachable -j ACCEPT
/sbin/iptables -A INPUT -i $MAIN_NIC -p icmp --icmp-type time-exceeded -j ACCEPT
/sbin/iptables -A INPUT -i $MAIN_NIC -p icmp --icmp-type echo-reply -j ACCEPT

# Opened ports
for nPort in $OPEN_PORTS
do
  /sbin/iptables -A INPUT -p tcp -i $MAIN_NIC --dport $nPort -j ACCEPT
  /sbin/iptables -A INPUT -p udp -i $MAIN_NIC --dport $nPort -j ACCEPT
done


# Ensure no NetBIOS leaks
/sbin/iptables -A OUTPUT -p tcp -o $MAIN_NIC --dport 137:139 -j DUMP
/sbin/iptables -A OUTPUT -p udp -o $MAIN_NIC --dport 137:139 -j DUMP
/sbin/iptables -A FORWARD -p tcp -o $MAIN_NIC --dport 137:139 -j DUMP
/sbin/iptables -A FORWARD -p udp -o $MAIN_NIC --dport 137:139 -j DUMP

# Set up NAT for internal network
if !(test "$ALTERNATE_NIC" = "")
then
  /sbin/iptables -A INPUT -s $ALTERNATE_NET -i $ALTERNATE_NIC -j ACCEPT
  /sbin/iptables -t nat -A POSTROUTING -o $MAIN_NIC -j SNAT --to-source $MAIN_IP
fi

# push everything else to state table
/sbin/iptables -A INPUT -j STATEFUL

# Ban IP addresses from list:
for address in $BANNED_IP_ADDRESSES
do
  iptables  -I INPUT -i eth0 -s $address -j DROP
done

